Apache 2

#!/usr/bin/env bash
# check_apache_111788.sh
# Validate exposure for Tenable plugin 111788 / Apache < 2.4.34 multiple vulns
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

INPUT_BIN="${1:-}"
APACHECTL=""
HTTPD_BIN=""
PKGVER=""
UPSTREAM_VER=""
MODULES=""
HAS_HTTP2=0
HAS_MD=0

find_bin() {
  local x
  for x in "$@"; do
    if [ -n "$x" ] && command -v "$x" >/dev/null 2>&1; then
      command -v "$x"
      return 0
    fi
    if [ -n "$x" ] && [ -x "$x" ]; then
      echo "$x"
      return 0
    fi
  done
  return 1
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

version_gt() {
  [ "$1" != "$2" ] && version_ge "$1" "$2"
}

version_lt() {
  ! version_ge "$1" "$2"
}

# Locate control/binary
if [ -n "$INPUT_BIN" ]; then
  APACHECTL="$(find_bin "$INPUT_BIN")" || true
fi

if [ -z "$APACHECTL" ]; then
  APACHECTL="$(find_bin apachectl apache2ctl /usr/sbin/apachectl /usr/sbin/apache2ctl httpd /usr/sbin/httpd)" || true
fi

if [ -z "$APACHECTL" ]; then
  echo "UNKNOWN - Apache control binary not found"
  exit 2
fi

HTTPD_BIN="$APACHECTL"

# Collect version string
VER_OUT="$($HTTPD_BIN -v 2>/dev/null || true)"
UPSTREAM_VER="$(printf '%s\n' "$VER_OUT" | sed -n 's/.*Apache\/\([0-9][0-9.]*\).*/\1/p' | head -n1)"

if [ -z "$UPSTREAM_VER" ]; then
  echo "UNKNOWN - Could not parse Apache version from: $HTTPD_BIN"
  exit 2
fi

# Collect loaded modules
MODULES="$($APACHECTL -M 2>/dev/null || true)"
printf '%s\n' "$MODULES" | grep -Eq 'http2_module|mod_http2' && HAS_HTTP2=1 || true
printf '%s\n' "$MODULES" | grep -Eq 'md_module|mod_md' && HAS_MD=1 || true

# Package metadata for backport warning
if command -v rpm >/dev/null 2>&1; then
  PKGVER="$(rpm -q --qf '%{NAME} %{VERSION}-%{RELEASE}\n' httpd 2>/dev/null | head -n1)"
elif command -v dpkg-query >/dev/null 2>&1; then
  PKGVER="$(dpkg-query -W -f='${Package} ${Version}\n' apache2 2>/dev/null | head -n1)"
fi

# Distro backport guardrail: old package versions on enterprise distros are often patched.
# If package metadata suggests a distro build older than upstream 2.4.34, do not claim VULNERABLE solely from version.
if [ -n "$PKGVER" ] && printf '%s\n' "$PKGVER" | grep -Eq '(el[0-9]|ubuntu|deb)'; then
  # We can still make a strong call for unaffected versions and for upstream >= 2.4.34
  if version_ge "$UPSTREAM_VER" "2.4.34"; then
    echo "PATCHED - Upstream Apache version $UPSTREAM_VER is >= 2.4.34"
    exit 0
  fi
  if [ "$UPSTREAM_VER" = "2.4.31" ] || [ "$UPSTREAM_VER" = "2.4.32" ]; then
    echo "PATCHED - Versions 2.4.31 and 2.4.32 are below 2.4.34 but not affected by the CVEs in plugin 111788"
    exit 0
  fi
  if version_lt "$UPSTREAM_VER" "2.4.18"; then
    echo "PATCHED - This advisory's mod_http2 issue starts at 2.4.18 and mod_md issue is only 2.4.33"
    exit 0
  fi
  echo "UNKNOWN - Distro package/backport detected ($PKGVER). Need vendor advisory plus module check to confirm actual exposure. Modules: http2=$HAS_HTTP2 mod_md=$HAS_MD upstream=$UPSTREAM_VER"
  exit 2
fi

# Pure upstream logic
if version_ge "$UPSTREAM_VER" "2.4.34"; then
  echo "PATCHED - Apache $UPSTREAM_VER"
  exit 0
fi

if [ "$UPSTREAM_VER" = "2.4.31" ] || [ "$UPSTREAM_VER" = "2.4.32" ]; then
  echo "PATCHED - Apache $UPSTREAM_VER is not affected by CVE-2018-1333 or CVE-2018-8011"
  exit 0
fi

if version_lt "$UPSTREAM_VER" "2.4.18"; then
  echo "PATCHED - Plugin 111788 CVEs do not apply before 2.4.18 (mod_http2 issue) and 2.4.33 (mod_md issue)"
  exit 0
fi

if [ "$UPSTREAM_VER" = "2.4.33" ]; then
  if [ "$HAS_HTTP2" -eq 1 ] || [ "$HAS_MD" -eq 1 ]; then
    echo "VULNERABLE - Apache 2.4.33 with relevant module loaded (http2=$HAS_HTTP2 mod_md=$HAS_MD)"
    exit 1
  else
    echo "PATCHED - Apache 2.4.33 present but neither mod_http2 nor mod_md appears loaded"
    exit 0
  fi
fi

# 2.4.18 - 2.4.30: only the HTTP/2 issue applies
if version_ge "$UPSTREAM_VER" "2.4.18" && version_lt "$UPSTREAM_VER" "2.4.31"; then
  if [ "$HAS_HTTP2" -eq 1 ]; then
    echo "VULNERABLE - Apache $UPSTREAM_VER with mod_http2 loaded"
    exit 1
  else
    echo "PATCHED - Apache $UPSTREAM_VER present but mod_http2 does not appear loaded"
    exit 0
  fi
fi

echo "UNKNOWN - Unhandled combination: upstream=$UPSTREAM_VER http2=$HAS_HTTP2 mod_md=$HAS_MD pkg='$PKGVER'"
exit 2